SAP Security Case Studies
Explore real-world SAP security scenarios and discover how DefenceMore One Click Audit for SAP helps detect and prevent security threats in SAP systems.
SAP_ALL Authorization Profile Misuse
Scenario
A request for the SAP_ALL authorization profile has been submitted via the helpdesk system for a user (this could also be a firefighter account). The system administrator who granted the authorization forgot to set an expiration date. Normally, SAP_ALL authorization should only be granted for one day, but the firefighter user has been using it for a week. During this time, the user intentionally accessed payroll tables and assigned new roles to other users.
Brute Force Attack on Predefined Accounts
Scenario
A brute force attack (password guessing or cracking) is being carried out on user accounts via the SAProuter from an external network. The goal of the attack is to compromise the passwords of critical predefined accounts such as DDIC, SAP*, and TMSADM. For this purpose, a password cracking attempt has been initiated.
Critical RFC Authorization Vulnerability
Scenario
An authorization personnel decided to create a new role for a request involving an RFC connection. In the role they created, they added the S_RFC authorization object. However, by assigning * to the parameters of the S_RFC object, they caused a security vulnerability.
HR Module Authorization Vulnerability
Scenario
An authorization personnel accidentally created a role for an employee by assigning critical-level parameter values to the P_ORGIN and P_ORGINCON authorization objects, which control access to infotypes in the Human Resources module.
System Authorization Profile Misuse
Scenario
The S_A.SYSTEM authorization profile has been assigned to a newly created user.
Inactive User Account Reactivation
Scenario
A malicious user has reactivated an inactive user account belonging to an employee who has not used the system for a long time by unlocking it.
Weak Password Length Configuration
Scenario
The login/min_password_lng parameter in the SAP system is set to '6'.
Insecure Password Configuration
Scenario
The login/no_automatic_user_sapstar parameter is set to '0'.
External Program Authorization Risk
Scenario
A Java program connecting to the SAP system retrieves and processes certain data. The user created for this connection has been assigned the SAP_ALL authorization. Users who gain control of this program could exploit it to make critical RFC calls, access sensitive data, and manipulate the data through the program.
Password Hash Code Theft Prevention
Scenario
A malicious user who has infiltrated the system with a user account attempts to obtain password hash codes and use Hashcat or similar tools to crack the passwords.
Security Audit Log Disabled
Scenario
The Security Audit Log (SAL) has been disabled by a malicious user who infiltrated the system, using RSAU_CONFIG or the SM19 transaction code.
Debug Authority Check Bypass
Scenario
A malicious user exploits a program vulnerability to infiltrate the system and attempts to bypass AUTHORITY-CHECK using debugging in a live system to escalate their privileges.
Insecure ABAP Code Detection
Scenario
An ABAP developer, who is not familiar with SAP security best practices, includes a code block in a program that could create a security vulnerability. A user who is aware of these vulnerabilities may attempt to exploit them.
HANA Backup Failure Detection
Scenario
A HANA database backup was either canceled by malicious users or failed due to a routine error, resulting in no backups being taken for 10 days.
Dynamic Parameter Manipulation
Scenario
A malicious user activated the dynamic parameter sapgui/user_scripting in the system and executed a harmful MS Excel macro.
RSBDCOS0 Program Misuse Prevention
Scenario
A malicious user, who has authorization to run the RSBDCOS0 program, attempts to delete files by executing the rm -rf command on a Linux-based application server in order to damage the system.
Critical Security Note Compliance
Scenario
A critical SAP note, CVE-XXX, with a security score of 9.8, was published the previous night. Hackers and attackers are attempting to exploit the vulnerability described in the note to infiltrate the system.
SAP Router Logging Disabled
Scenario
SAP Router is not logging the traffic passing through it.
SAP Router Configuration File Protection
Scenario
A malicious hacker from the external network intends to modify the SAP Router configuration file.
HANA Audit Log Disabled
Scenario
A malicious user with direct access to the HANA Database has disabled the HANA DB AUDIT LOG mechanism, preventing the generation of logs.
HANA Database Brute Force Attack
Scenario
A brute-force attack is being attempted on the HANA Database targeting the 'SYSTEM' user and other critical users through password trial attempts.
HANA Database Privilege Escalation
Scenario
A ordinary user is granted 'DATA ADMIN' privileges on the live HANA Database.